Fedora Legacy Test Update Notification: httpd

[Marc Deslauriers]

Packages were updated to provide stripped binaries.

---------------------------------------------------------------------
Fedora Legacy Test Update Notification
FEDORALEGACY-2004-2068
Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2068
2004-10-04
---------------------------------------------------------------------

Name        : httpd
Versions    : 9: 2.0.40-21.16.legacy, fc1: httpd-2.0.51-1.4.legacy
Summary     : The httpd Web server
Description : 
This package contains a powerful, full-featured, efficient, and
freely-available Web server based on work done by the Apache Software
Foundation. It is also the most popular Web server on the Internet.

---------------------------------------------------------------------
Update Information:

Problems that apply to Red Hat Linux 9 only:

A stack buffer overflow was discovered in mod_ssl that could be
triggered if using the FakeBasicAuth option. If mod_ssl was sent a
client certificate with a subject DN field longer than 6000 characters,
a stack overflow occured if FakeBasicAuth had been enabled. In order to
exploit this issue the carefully crafted malicious certificate would
have had to be signed by a Certificate Authority which mod_ssl is
configured to trust. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0488 to this issue.

A remotely triggered memory leak in the Apache HTTP Server earlier than
version 2.0.50 was also discovered. This allowed a remote attacker to
perform a denial of service attack against the server by forcing it to
consume large amounts of memory. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0493 to
this issue.

Problems that apply to Fedora Core 1 only:

Testing using the Codenomicon HTTP Test Tool performed by the Apache
Software Foundation security group and Red Hat uncovered an input
validation issue in the IPv6 URI parsing routines in the apr-util
library. If a remote attacker sent a request including a carefully
crafted URI, an httpd child process could be made to crash. This issue
is not believed to allow arbitrary code execution on this platform.
This issue also does not represent a significant denial of service
attack as requests will continue to be handled by other Apache child
processes. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0786 to this issue.

An input filter bug in mod_ssl was discovered in Apache httpd version
2.0.50 and earlier. A remote attacker could force an SSL connection to
be aborted in a particular state and cause an Apache child process to
enter an infinite loop, consuming CPU resources. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0748 to this issue.

Note that these packages do also contain the fix for a regression in
Satisfy handling in the 2.0.51 release (CAN-2004-0811).

Problems that apply to both Red Hat Linux 9 and Fedora Core 1:

The Swedish IT Incident Centre (SITIC) reported a buffer overflow in the
expansion of environment variables during configuration file parsing.
This issue could allow a local user to gain 'apache' privileges if an
httpd process can be forced to parse a carefully crafted .htaccess file
written by a local user. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0747 to this
issue.

An issue was discovered in the mod_ssl module which could be triggered
if the server is configured to allow proxying to a remote SSL server. A
malicious remote SSL server could force an httpd child process to crash
by sending a carefully crafted response header. This issue is not
believed to allow execution of arbitrary code. This issue also does not
represent a significant Denial of Service attack as requests will
continue to be handled by other Apache child processes. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0751 to this issue.

An issue was discovered in the mod_dav module which could be triggered
for a location where WebDAV authoring access has been configured. A
malicious remote client which is authorized to use the LOCK method could
force an httpd child process to crash by sending a particular sequence
of LOCK requests. This issue does not allow execution of arbitrary code.
This issue also does not represent a significant Denial of Service
attack as requests will continue to be handled by other Apache child
processes. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0809 to this issue.

---------------------------------------------------------------------
9 changelog:

* Sun Oct 03 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.40-21.16.legacy
 
- Rebuilt

* Sat Oct 02 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.40-21.15.legacy
 
- added missing autoconf, libtool, zlib-devel, gdbm-devel BuildPrereq
 
* Thu Sep 16 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.40-21.14.legacy
 
- add security fixes for CVE CAN-2004-0747, CAN-2004-0751, CAN-2004-0809
 
* Fri Jul 02 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.40-21.13.legacy
 
- add security fix for CVE CAN-2004-0493
 
* Wed Jun 02 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.40-21.12.legacy
 
- add security fix for CVE CAN-2004-0488

fc1 changelog:

* Sun Oct 03 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.51-1.4.legacy
 
- Rebuilt

* Sat Oct 02 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.51-1.3.legacy
 
- added missing autoconf, libtool, zlib-devel, gdbm-devel BuildPrereq
 
* Fri Sep 24 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
2.0.51-1.2.legacy
 
- fix 2.0.51 regression in Satisfy merging (CAN-2004-0811)
- ap_rgetline_core fix from Rici Lake
 
* Wed Sep 15 2004 Joe Orton <jorton at redhat.com> 2.0.51-1.1
 
- update to 2.0.51, including security fixes for:
 * core: CAN-2004-0747
 * mod_dav_fs: CAN-2004-0809
 * mod_ssl: CAN-2004-0751, CAN-2004-0748

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/
(sha1sums)

4e087267eecc22511da946cfa48bbc323eca06c9 
fedora/1/updates-testing/i386/httpd-2.0.51-1.4.legacy.i386.rpm
6e93aa37526472d11a8c2f31e58e89b920dac08c 
fedora/1/updates-testing/i386/httpd-devel-2.0.51-1.4.legacy.i386.rpm
09af35f59d8bfd42a4b2988af5ce869e0daf4fcc 
fedora/1/updates-testing/i386/httpd-manual-2.0.51-1.4.legacy.i386.rpm
2c125be93507e8ed0e672f0459b06b719678264b 
fedora/1/updates-testing/i386/mod_ssl-2.0.51-1.4.legacy.i386.rpm
5629ec56b7b4935f8540c5884ec3d03a4d5e09cd 
fedora/1/updates-testing/SRPMS/httpd-2.0.51-1.4.legacy.src.rpm
24afb48553b515210d3169791dcdd7d39a5d48d6 
redhat/9/updates-testing/i386/httpd-2.0.40-21.16.legacy.i386.rpm
6e331ab50f8ddfc5674941a624cb9964863e5375 
redhat/9/updates-testing/i386/httpd-devel-2.0.40-21.16.legacy.i386.rpm
0f173510cd129e3705bfaef42e29ff0534ceb4a3 
redhat/9/updates-testing/i386/httpd-manual-2.0.40-21.16.legacy.i386.rpm
3983d36be504848260d839f9da54987fd6ec5bc6 
redhat/9/updates-testing/i386/mod_ssl-2.0.40-21.16.legacy.i386.rpm
985775546a6372e6593735521e1729baefde46ba 
redhat/9/updates-testing/SRPMS/httpd-2.0.40-21.16.legacy.src.rpm

---------------------------------------------------------------------

Please test and comment in bugzilla.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/fedora-legacy-list/attachments/20041003/faf19553/attachment.sig>